DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


To: H&L Business Consulting Limited 


Of: White House, Keld, Penrith CA10 3QF 


1. The Information Commissioner (“the Commissioner”) has decided to 
issue H&L Business Consulting Limited (“H&L”) with a monetary 
penalty under section 55A of the Data Protection Act 1998 (“DPA”). 
The penalty is in relation to a serious contravention of Regulations 
22 and 23 of the Privacy and Electronic Communications (EC 
Directive) Regulations 2003 (“PECR”). 


2. This notice explains the Commissioner's decision. 


Legal framework 


3. H&L, whose registered office address is given above (Companies 
House Registration Number: 12061236) is the organisation stated 
in this notice to have transmitted unsolicited communications by 
means of electronic mail to individual subscribers for the purposes 


of direct marketing contrary to regulation 22 of PECR. 


4. Regulation 22 of PECR states: 


“(1) This regulation applies to the transmission of unsolicited 
communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a 
person shall neither transmit, nor instigate the transmission of, 
unsolicited communications for the purposes of direct marketing 
by means of electronic mail unless the recipient of the electronic 
mail has previously notified the sender that he consents for the 
time being to such communications being sent by, or at the 


instigation of, the sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the 
recipient of that electronic mail in the course of the sale 
or negotiations for the sale of a product or service to 


that recipient; 


(b) the direct marketing is in respect of that person’s 


similar products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission 
of the refusal) the use of his contact details for the 
purposes of such direct marketing, at the time that the 
details were initially collected, and, where he did not 
initially refuse the use of the details, at the time of each 


subsequent communication. 


(4) A subscriber shall not permit his line to be used in contravention 


of paragraph (2).” 
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Regulation 23 of PECR states: 


“A person shall neither transmit, nor instigate the 
transmission of, a communication for the purposes of direct 
marketing by means of electronic mail - 

(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 
concealed; 

(b) where a valid address to which the recipient of the 
communication may send a request that such communications 
cease has not been provided 

(c) where that electronic mail would contravene regulation 7 
of the Electronic Commerce (EC Directive) Regulations 2002; 
or 

(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 


Section 122(5) of the Data Protection Act 2018 “DPA18” defines 
direct marketing as “the communication (by whatever means) of 
any advertising material which is directed to particular individuals”. 
This definition also applies for the purposes of PECR (see regulation 
2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of the 
DPA18). 


Consent in PECR is now defined, from 29 March 2019, by reference 
to the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. 
Article 4(11) of the GDPR sets out the following definition: 
“consent’ of the data subject means any freely given, specific, 


informed and unambiguous indication of the data subject's wishes 
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by which he or she, by a statement or by a clear affirmative action, 
signifies agreement to the processing of personal data relating to 


him or her”. 


Recital 32 of the GDPR materially states that “When the processing 
has multiple purposes, consent should be given for all of them”. 
Recital 42 materially provides that “For consent to be informed, the 
data subject should be aware at least of the identity of the 
controller”. Recital 43 materially states that “Consent is presumed 
not to be freely given if it does not allow separate consent to be 
given to different personal data processing operations despite it 


being appropriate in the individual case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living 


individual and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person 
who is a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in 
the recipient’s terminal equipment until it is collected by the 
recipient and includes messages sent using a short message 


service”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


“(1) The Commissioner may serve a person with a monetary 


penalty if the Commissioner is satisfied that - 


13. 


14. 


15. 


(a) there has been a serious contravention of the 
requirements of the Privacy and Electronic 
Communications (EC Directive) Regulations 2003 by the 


person, 
(b) subsection (2) or (3) applies. 

(2) This subsection applies if the contravention was deliberate. 

(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C 
(1) of the DPA about the issuing of monetary penalties that has 
been published on the Information Commissioner’s Office (“ICO”) 
website. The Data Protection (Monetary Penalties) (Maximum 
Penalty and Notices) Regulations 2010 prescribe that the amount of 
any penalty determined by the Commissioner must not exceed 
£500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ 


privacy rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) 
of Schedule 20 to the DPA18. 


Background to the case 
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Mr Julius Gray (“Mr Gray”) has been a company director since 2005. 
His previous directorships include Lime Loans Limited, Help 
Marketing Limited, J.E.R. Marketing Limited, J.E.R. Finance Limited, 
The Help Group Limited, Peracto Marketing Limited, Connecttxt.com 
Limited, The Mint Condition Media Limited and The Gray Label Inc 
Limited. The first four of those companies were dissolved via 
voluntary strike-off in 2010 and 2011. The remaining five 
companies were dissolved via compulsory strike-off in 2010 and 
2017. 


Between 7 June 2017 and 6 June 2019, Mr Gray was listed on the 


ICO’s data protection register as a sole trader. 


In June 2019, Mr Gray came to the attention of the ICO during an 
investigation into SMS messages promoting the website 
www.outofdebts.co.uk. In response to a third party information 
notice, the telecommunications service provider EE identified 
EE as the customer to whom the mobile telephone numbers 
generating the messages were allocated. EE then identified 
EE 2s the subscriber, and informed the 
ICO that the SMS messages had been ordered by, and the data had 
been provided by, their client, Mr Gray of JG Consulting. 


The ICO’s attempts to contact Mr Gray in 2019 in connection with 
its investigation into the website www.outofdebts.co.uk came to a 
dead end, because, with the exception of three short holding emails 
in July and August 2019, Mr Gray failed to respond to the ICO. 


Attempts to contact him by post were unsuccessful. The ICO 
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therefore closed its investigation into JG Consulting on 26 March 
2020. 


H&L was incorporated on 20 June 2019 and is registered with 
Companies House under company number 12061236. Itis owned 
and controlled by Mr Gray, who is the sole director and company 
secretary, and the nature of its business is listed as “information 
technology consultancy activities”. H&L has been registered with 
the ICO since 28 May 2020, where the nature of its work is listed as 
“marketing agency” and the contact is Mr Gray. H&L does not 


appear to have a website. 


H&L came to the attention of the ICO during an investigation into 


scams and exploitative marketing surrounding the COVID-19 crisis. 


Mobile phone users can report the receipt of unsolicited marketing 
text messages to Mobile UK’s Spam Reporting Service by forwarding 
the message to 7726 (spelling out “SPAM”). Mobile UK is an 
organisation that represents the interests of mobile operators in the 
UK. 


On 12 May 2020, the ICO’s keyword search for the word “lockdown” 
revealed several complaints to the 7726 spam reporting service, 
concerning unsolicited SMS promoting the websites 
“outofdebtuk.co.uk” and “out-of-debts.co.uk”. The content of the 


SMS messages was: 


e Get Debt FREE during the Lockdown! Write off 95% of ALL 
DEBTS with ALL charges and fees FROZEN. Government 


backed. Click http://outofdebtuk.co.uk. Stop 2optout 


e Get Debt FREE during the Lockdown! Write off 95% of ALL 
DEBTS with ALL charges and fees FROZEN. Government 
backed. Click http://out-of-debts.co.uk. Stop 2optout 


24. The ICO searched the 7726 database and identified a total of 159 
complaints about unsolicited SMS messages promoting the websites 
outofdebtuk.co.uk and out-of-debts.co.uk between 13 January and 
23 May 2020. The ICO also searched the complaints submitted via 
the ICO’s own Online Reporting Tool and identified three further 
complaints from individual subscribers in the period 13-20 May 
2020: two out of the three complainants said the messages had 
made them feel annoyed and/or anxious; one said it was a 


disruption; one said, “My phone is not their advertising platform.” 


25. The websites stated that outofdebtuk.co.uk and out-of-debts.co.uk 
were trading names of eo = whose registered office was at 
Kemp House in London. The websites and privacy policies also 
contained several references to “outofdebts.co.uk”, which was the 
same website which had been investigated by the ICO in 2019 
referred to above. 


26. The privacy policies on outofdebtuk.co.uk and out-of-debts.co.uk 
both stated: 
“By accepting our privacy policy and opt-ing IN, the data we 
collect from you may be sold (or otherwise passed on) to our 
clients and carefully selected third parties. The information 
passed on may include personal details such as name, postal 


address, telephone number and date of birth.” 


27. The privacy policies went on to list the following 42 sectors about 


which website users could expect to receive third party marketing: 
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Automotive, Automotive, Broadband, Call Centre, Charity, 
Competition Sites, Debt, Education, 
Entertainment\Gaming\Leisure, Fashion, Finance, 

FMCG, Freebie Sites, Gambling, Gardening, Government, 
Health & Beauty, Home & Lifestyle, Mobility, Home 
Improvement, Household, IT/Technical, Insurance (Life, 
Home, Automotive, General, Private Medical, Travel), Legal 
Services, Lottery, Mail Order, Market Research, Music, 
Pension, Pharmaceutical, Claims for mis-sold PPI, Claims for 
Flight Delay, Claims for Road Traffic accidents, General 
Claims, Premium Rate, Publishing/Media, Retail, Sport, 
Telecoms, Toiletries/Cosmetics, Travel, Utilities, Claims for 


Packaged Bank Account Fees. 


In addition, the privacy policy on the website outofdebtuk.co.uk 
listed the following named third parties as companies from which 
users could expect to received marketing: “ME ‘iia 


The privacy policy on www.outofdebtuk.co.uk appeared to have 


been copied from a company called M as it included 


a several references to that company. 


On 26 May 2020, the ICO sent an initial investigation letter to 
ars informing it of the complaints received by the ICO and 
the mobile telephone networks. The letter outlined the 
requirements of PECR and the enforcement powers available to the 
ICO and requested [ to answer a number of questions 
by 16 June 2020. On 4 June 2020, NN contacted the ICO 
to say that it had not sent any marketing text messages, but that it 


had a client who used to take leads who had put the company’s 


3L. 
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34. 


details on its website. ———— subsequently confirmed that 
out-of-debts.co.uk “was a page we used to use with social 
marketing” and “the page is not owned by me but was by a 
company I was working with back of 2019, looks like they have kept 
details on and started other forms of marketing”. PF 


gave the ICO contact details for the company as “HandLlitd; 


The ICO searched the data protection register, which revealed that 
the telephone number provided by EEE for TE was 
listed as the contact telephone number on the expired data 


protection register entry for Mr Gray. 


On 9 June 2020, the ICO emailed ME asking it to provide 
a copy of its contact with HandLlItd; the name and postal address of 
the person with whom they dealt; the name and contact details of 
the client who purchased the leads generated by HandLitd; and 
copies of any correspondence it had had with these companies 
regarding the use of his company’s details on the website out-of- 


debts.co.uk. 
Within an hour, Mr Gray emailed the ICO from to say: 


I’ve been made aware that you have requested some 
information from a previous client of mine (... 
regarding outofdebts.co.uk and leads generated via this site. 
This was a project I was involved in at the time. Could you 
kindly let me know what information is required from me and 


I will happily come back to you. 


On 10 June 2020, the ICO sent a letter by email to Mr Gray 


outlining the requirements of PECR and the enforcement powers 
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available to the ICO and asked him to provide answers to various 
questions by 1 July 2020. The accompanying spreadsheet listed 
548 complaints which had been received by the ICO and the mobile 
telephone networks between 21 February 2018 and 7 June 2020 
about unsolicited SMS messages promoting the websites 


www.outofdebts.co.uk, www.out-of-debts.co.uk and 


www.outofdebtuk.co.uk. 


Mr Gray did not respond to the ICO substantively by the deadline of 
1 July 2020, so the ICO reminded him by email on 3 July 2020 and 
gave him an extended deadline of a further seven days. The email 
pointed out that, as a final resort, the Commissioner could decide to 
issue an information notice compelling him to provide the 


information he sought. 


On 3 July 2020, Mr Gray replied, claimed to be “working on this still 
and awaiting news from various suppliers etc”, and requested a 
two-week extension “in order to gather everything together”. The 
extension was approved by the ICO and confirmed to Mr Gray the 


same day. 


Mr Gray did not respond by the new deadline of 17 July 2020, 
therefore on 21 July 2020, the ICO reminded him by email again, 
acknowledging that he was waiting for information from his 
suppliers but asking him to provide the rest of the information, and 
to send the missing information as soon as he received it. The 
email ended with a warning that if a substantive response was not 
received by 24 July 2020, then the ICO would consider issuing an 
information notice formally compelling him to provide the 


information. 
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On 27 July 2020, Mr Gray sent a short holding email, apologising for 
his failure to reply the previous week. He explained that he had 
been away with his new job on a training course. He undertook to 
“dedicate all my time to this today and tomorrow and get all the 
information I can to you by end of play on Tuesday 28t”. Again, Mr 


Gray did not respond by the deadline. 


On 1 September 2020, the ICO issued a third party notice to the 
telecommunications service provider, | OY requesting 
subscriber details for three mobile telephone numbers which 
appeared to have been used to send the SMS messages which had 
generated the subject of complaints by subscribers in the period 16 
January 2020 - 27 August 2020. 


On 24 September 2020, the ICO sent an information notice by post 
to Mr Gray requiring JG Consulting to provide the information within 


35 days, and stating that failure to respond was a criminal offence. 


On 7 October 2020, Mr Gray replied by email and stated that JG 

Consulting was no longer trading. He stated: 
“I am attempting to provide you with the answers to Annex 1 
within the required time frame but I am facing a number of 
issues. Primarily, JG Consulting is no longer trading. I am 
now in full time employment and no longer self employed and 
also, I no longer own the laptop which I ran the business 
from. I can from memory provide some answers, but want to 
check with you what the implications are for NOT providing 
certaining (sic) information (for the above mentioned 


reasons)?” 


On 8 October 2020, the ICO emailed Mr Gray asking him to confirm 


when he ceased trading as JG Consulting and when his new 
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43. 
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company, H&L, started trading. The email confirmed that the 
information notice required him to provide information held by him 
in his capacity as a sole trader. His comments about the laptop 
were noted by the ICO, but it was also noted that sole traders are 
legally required to keep records for at least five years for tax 
purposes and that he should still have access to emails held in his 
GoogleMail account. The email reiterated that failure to comply 


with an information notice was a criminal offence. 


On 8 October 2020, Companies House published a document 
showing that on 7 October 2020, H&L changed its registered office 


address from Newbeggin, Penrith to White House, Keld, Penrith. 


Mr Gray emailed the ICO on 13 October 2020 requesting a 28-day 
extension of time to comply with the information notice. The ICO 
acknowledged it on the same day and reminded Mr Gray that he 
had already had over four months to gather the information. The 
ICO asked him to provide as much information as possible by the 
new deadline of 31 October 2020 and to let the ICO know when he 


would be in a position to provide the remaining information. 


On 13 October 2020, the ICO received a response from u 
which confirmed that the mobile telephone numbers about which 
the ICO had sought information were allocated to BE. The 
WE Website describes it as an SMS platform provider offering 
bulk SMS marketing solutions to organisations. 


On 14 October 2020, the ICO opened an investigation into ii 
= to establish whether it had been sending unsolicited SMS 
messages on behalf of third parties in breach of regulations 22 and 
23 of PECR. On 26 October 2020, the ICO sent Man initial 


investigation letter, informed it of the complaints received, outlined 
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the requirements of PECR and the ICO’s enforcement powers, and 
invited it to answer certain questions. On 2 November 2020, i” 
GE replied and explained that it is a communications service 
provider and that its users access their service via a self-service 
web portal or application programming interface. All users agree to 
be bound by TE terms of service, which state that users 
must comply with the laws surrounding consent. The relevant 
sections Say: 
“You shall only send solicited content and promotional 
messages when using aan, 
You shall only send messages to recipients who have opted in 
to receive messages. If You breach the obligations herein 
provided, EE reserves the right to 
suspend the Services provided to You accordingly, without 


refund. 


You undertake that you will not knowingly use the Services 
for any illegal, immoral, or improper purposes or in any other 
manner which contravenes any third-party rights, any laws or 
requirements of a Regulator in the appropriate jurisdiction, or 
in any way which is indecent or offensive or in any way that 
could be considered as spamming and undertake not to allow 


any third-party to do so. 


You are fully responsible for the content submitted through 


ee Systems, its nature, timing and 


other specifics nature. You warrant that all content You 


submit through inl systems 
(including but not limited to SMS sent via 
PE bulk SMS solution): (i) is sent only to 


recipients who have provided consent to receive the content 


in line with the Data Protection Legislation, where such 
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consent is required; and (ii) contains a link or similar to 
enable the recipient to unsubscribe from further 
communications from You, as required by the Data Protection 
Legislation, and You warrant that You will comply with any 


unsubscribe request received.” 


47. GE informed the ICO that the messages concerning 
outofdebtsuk.co.uk and out-of-debts.co.uk had been sent by a 
subscriber named Julius Grey (sic) of JG Consulting, Penrith, and H&L 
Business Consulting Ltd, Covent Garden. [MM confirmed that 
Julius Grey had sent a total of 584,632 SMS messages between 1 
September 2019 and 23 October 2020, of which 497,474 messages 
were delivered. MM provided copies of two invoices issued to 
JG Consulting on 10 December 2019 and 27 January 2020, covering 
a total of 60,083 SMS credits at the cost of £721 and 47 invoices 
issued to H&L between 20 January 2020 and 22 September 2020, 
covering 460,123 SMS credits at the cost of £5,521.50. 


48. The ICO issued a third party information notice to TE on 18 
November 2020, requesting further information about JG Consulting 
and H&L, including the full list of telephone numbers allocated, the 
connection dates and usage periods, payment details and copies of 


message logs. 


49. a responded on 10 December 2020 confirming that Julius 
Grey (sic) had two virtual mobile telephone numbers allocated to 
him. [RM bad been allocated to him on 3 August 2019 and 
had last been used on 27 July 2020. P o been 
allocated to him on 26 November 2019 and had last been used on 22 
July 2020. Payments had originally been received from “Gray JH”, 


however, since 27 January 2020, payments had been from H&L. I 
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Media also provided message logs listing 140,580 SMS messages 
sent by H&L between 18 May 2020 and 27 July 2020. 


The ICO analysed the message logs and observed that whereas the 
earlier messages asked recipients to visit the website 
outofdebtuk.co.uk or out-of-debts.co.uk, the messages sent between 
22 July and 27 July 2020 did not contain a website address but 
instead asked recipients to reply with the keyword “INFO” or “DEBT 
2”. The message logs also included 4,016 messages sent on 2 June 


2020 containing the website address 


Having considered the information provided by], the ICO 
decided to refocus its investigation on to H&L, send an information 
notice to H&L, and give H&L time to respond. The ICO conducted 
further searches of the 7726 complaints database, which identified a 
total of 314 complaints about SMS messages promoting the websites 


outofdebtuk.co.uk, out-of-debts.co.uk cr aaa 


or which were sent from the virtual mobile telephone numbers 
C > hich) RR ac allocated to mr 
Julius Grey, between 20 January 2020 and 21 November 2020. The 
ICO also searched its online reporting tool and identified a further 


eight complaints between 20 January 2020 and 23 July 2020. 


On 19 January 2021, the ICO sent an information notice by post to 
H&L’s registered office address at the White House, Keld, Penrith, 
requiring the company to provide specified information by 23 
February 2021, and reiterating that failure to respond to an 


information notice was a criminal offence. 


On 22 January 2021, the ICO sent a copy of the information notice 


Mr Gray by email, along with an electronic copy of the complaints 
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spreadsheet and a request to contact the investigating officer for the 
password. The ICO received an automated read receipt less than 
two hours later confirming that the message had been read on Friday 
22 January 2021 at 5.30 pm. 


On 8 March 2021, Mr Gray emailed the ICO to say, “Apologies as I 
am now employed I do not check this email very often. Please could 
you send me the password and I will have all the information sent 
over to you by Friday 12 March.” On the same day, the ICO sent 
him the password for the complaints spreadsheet and pointed out 
that the investigating officer had received a read receipt showing that 
Mr Gray had read the email on 22 January. Mr Gray thanked the ICO 
officer for the password and asked her to leave it with him. In 
explanation for the read receipt, he said, “I’f (sic) I mark all emails 
on my phone as ‘read’ I can do this without reading each one 


indivually (sic)”. 


Mr Gray did not reply by the deadline of 12 March 2021, therefore 
the ICO sent an email reminder on 15 March 2021. On the same 
day, Mr Gray responded and promised to provide the information by 
17 March 2021. He stated, “I have taken Wednesday off work to 
ensure I can finish a response for you. I worked on it on Friday but 
certain things I struggled with. Will be over and with you on 


Wednesday.” 


On 18 March 2021, Mr Gray sent a holding email, promising a 
response on 19 March 2021. He stated, “I’m nearly there with this 
request. I am off again on Friday and will ensure it’s over to you 


then. It’s taking longer than anticipated to complete!” 


The ICO received no response. On 11 May 2021, the ICO sent Mr 


Gray an email to explain that the investigation had ended, remind 
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him that failure to respond to an information notice was a criminal 

offence and point out that under PECR the onus was on H&L, as the 
sender of the messages, to prove that it had had valid consent. The 
email referred him to the introductory letter of 10 June 2020, which 


had outlined the enforcement powers available to the ICO, and 


explained that the ICO would now consider whether formal 


enforcement action was appropriate. The email gave him a further 


opportunity to provide any relevant evidence which he had, which he 


must do by 18 May 2021. No response was received. 
H&L’s registration with the ICO expired on 27 May 2021. 


The ICO emailed |i on 9 June 2021 asking him to confirm 
how many of the 584,632 SMS messages had been sent after 20 
January 2020, when the first invoice had been issued to H&L, in 
order to ascertain how many of the SMS messages sent by Mr Gray 
had been sent on behalf of JG Consulting and how many had been 
sent on behalf of H&L. [MMM informed the ICO on 16 June 
2021 that 451,705 SMS messages had been sent by the subscriber 
Julius Grey after 20 January 2020, of which 378,538 had been 
delivered. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 
The Commissioner has considered whether those facts constitute a 


contravention of regulations 22 and 23 of PECR by H&L and, if so, 


whether the conditions of section 55A DPA are satisfied. 
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The contravention 
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The Commissioner finds that H&L contravened regulation 22 of 
PECR as follows. The Commissioner finds that H&L sent 451,705 
SMS messages, of which 378,538 were delivered, which were 
unsolicited direct marketing message sent to subscribers who had 
not consented to receiving them, between 20 January 2020 and 27 
July 2020. This resulted in 314 complaints from subscribers 
through the 7726 spam reporting service and eight complaints 
through the ICO’s Online Reporting Tool. The Commissioner finds 
that H&L transmitted or instigated the transmission of those direct 


marketing messages contrary to regulation 22 of PECR. 


H&L as the sender or instigator of the direct marketing, is required 
to ensure that it is acting in compliance with the requirements of 
regulation 22 of PECR and to ensure that valid consent to those 


messages had been acquired. 


In this instance, H&L sought to profit from the Covid-19 pandemic, 
by sending messages to individuals offering them the opportunity to 
“Get Debt FREE during the Lockdown!”. Message logs provided by 
e: =; show that 92,702 of the messages sent by H&L between 
18 May and 23 June 2020 included that wording. The messages 
misleadingly referred to a “government solution”, “government 
help” or to the solution being “government backed”, despite the fact 
that H&L was not authorised by the FCA to provide products or 


services in connection with debt. 
The contravention continued despite the commencement of the ICO 


investigation into JG Consulting on 10 June 2020. H&L sent 14,329 
SMS messages between 23 June and 27 July 2020. 
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Mr Gray failed to co-operate with the ICO investigation and failed to 
respond to either the information notice issued against JG 
Consulting, under which he traded as a sole trader, or the 
information notice issued against H&L, of which he was the sole 


director and company secretary. 


The Commissioner considers that Mr Gray attempted to frustrate his 
investigation, by removing the website address from the wording of 
the SMS messages in the period 22-27 July 2020 and by changing 
H&L’s registered address following receipt of the first information 


notice. 


The Commissioner has noted that Mr Gray is part of an informal 
network of disqualified directors and liquidated companies, some of 
whom have been the subject of previous investigations by the ICO. 
The Commissioner infers that individual subscribers who responded 
positively to the SMS messages would have had their personal 
details sold or passed on to numerous third parties, resulting in 


further unsolicited marketing messages and possible financial loss. 


H&L did not take the opportunity to put forward an explanation or 
evidence to the Commissioner on whether the consent of 
subscribers had been obtained and, if so, the nature and extent of 


the consent, or when or how it had been given. 


The Commissioner’s direct marketing guidance says “organisations 
need to be aware that indirect consent will not be enough for texts, 
emails or automated calls. This is because the rules on electronic 
marketing are stricter, to reflect the more intrusive nature of 


electronic messages.” 
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However, it does go on to say that indirect consent may be valid, 
but only if it is clear and specific enough. If categories of 
organisations are referred to then those categories must be tightly 
defined and the organisation wanting to use the consent must 
clearly fall within the description. Consent is not likely to be valid 
where an individual is presented with a long, seemingly exhaustive 


list of categories of organisations. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent 


can be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type 


of organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always 
ensure that the language used is clear, easy to understand, and not 
hidden away in a privacy policy or small print. Consent will not be 
valid if individuals are asked to agree to receive marketing from 


WN WN 


“similar organisations”, “partners”, “selected third parties” or other 


similar generic description. 


The Commissioner is therefore satisfied from the evidence he has 
seen that H&L did not have the necessary valid consent for the 
451,705 SMS direct marketing messages which it sent to 
subscribers between 20 January 2020 and 27 July 2020, of which 
378,538 were delivered, which equates to an average of 63,089 a 


month or 14,019 a week. 
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76. 


77. 


Further, the Commissioner finds that H&L concealed its identity, in 


contravention of regulation 23 of PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


78. 


79. 


80. 


The Commissioner is satisfied that the contravention identified 
above was serious because of the high volume of messages over a 
sustained period of time. This is because between 20 January 2020 
and 27 July 2020, a confirmed total of 451,705 direct marketing 
messages were sent by or sent at the instigation of H&L by SMS, of 
which 378,538 were delivered. These messages contained direct 
marketing material for which subscribers had not provided valid 
consent, either directly or indirectly. The SMS messages sent by 
H&L between 20 January 2020 and 27 July 2020 resulted in 314 
complaints to the 7726 spam reporting service and eight complaints 
directly made to the ICO. 


Although 73,167 SMS messages were not delivered to subscribers, 
their existence evidences an attempt by H&L to send even larger 
volumes of marketing messages to individuals without consent to 
do so, in addition to the 378,538 SMS messages which were 


delivered. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 
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Deliberate or negligent contraventions 


81. The Commissioner has considered whether the contravention 
identified above was deliberate. In the Commissioner’s view, this 
means that H&L’s actions which constituted that contravention were 
deliberate actions (even if H&L did not actually intend thereby to 


contravene PECR). 


82. The Commissioner considers that in this case H&L did deliberately 


contravene regulations 22 and 23 of PECR. 


83. Mr Gray was the director of at least eleven companies between 
2005 and 2020, so he should have been aware of the requirements 
of PECR. He was investigated by the ICO in 2019 in connection with 
his work for JG Consulting, so he was aware of the complaints 
received about JG Consulting’s SMS marketing activities and the 


ICO’s concerns about compliance with PECR. 


84. Mr Gray failed to co-operate with the 2019 ICO investigation and 
instead set up a new company, H&L, with the apparent intention of 
concealing his activities from the regulator, the ICO. He omitted to 
mention his new company H&L in his correspondence with the ICO 
during July and August 2019, and registered H&L with the ICO only 
in May 2020 after the ICO had sent its initial investigation letter to 
FY from which Mr Gray must inevitably have realised 
that the ICO was going to identify H&L as the sender of the SMS 


messages being investigated. 


85. H&L sought to evade identification by falsely stating on their 


websites that outofdebtuk.co.uk and out-of-debts.co.uk were 


trading names of iy. 
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86. 


87. 


88. 


Mr Gray failed to provide any evidence of consent or any details of 
his relationships with the third parties who were mentioned during 


the ICO investigation. 


For the above reasons, the Commissioner is satisfied that this 


breach was deliberate. 


The Commissioner is therefore satisfied that condition (b) from 
section 55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


89. 


90. 


The Commissioner has taken into account the following 


aggravating features of this case: 


H&L concealed its identity, in contravention of regulation 23 of 
PECR. 

The contravention was motivated by the potential of financial gain. 
The ICO produces clear guidance via its website on the rules of 
direct marketing. In addition, the ICO operates a helpline, should 
organisations require further clarification in the event of any queries 
around their obligations under PECR. 

The investigation established a history of several years of Mr Gray’s 
involvement in a network of non-compliant organisations within the 
marketing sector. 

The investigation found that H&L adapted its SMS message content 
and changed its email address in an apparent indication of poor 


regulatory compliance. 


The Commissioner does not consider that there are any mitigating 


features of this case. 
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91. 


92. 


93. 


94. 


95. 


For the reasons explained above, the Commissioner is satisfied that 
the conditions from section 55A (1) DPA have been met in this case. 
He is also satisfied that the procedural rights under section 55B 


have been complied with. 


The latter has included the issuing of a Notice of Intent, in which 
the Commissioner set out his preliminary thinking and invited H&L 
to make representations in respect of this matter. In accordance 
with the requirements of section 65 of the DPA, the Notice of Intent 
was served on the registered office of H&L. The Commissioner 
believes that H&L may no longer be operating from that address 
and that Mr Gray has failed to inform Companies House. Therefore, 
the Notice of Intent was subsequently also sent to the 
correspondence address for Mr Gray registered with Companies 
House and the email address used by Mr Gray in his 
communications with the ICO in the course of the investigation. 
Despite this, no representations were received from H&L in 


response to the Notice of Intent. 


The Commissioner is accordingly entitled to issue a monetary 


penalty in this case. 


The Commissioner has considered whether, in the circumstances, 


he should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has attempted to consider the likely impact of a 
monetary penalty on H&L. However, there is no publicly available 
financial information available about the company. H&L was invited 
to provide financial representations in response to the Notice of 
Intent but failed to do so. The Commissioner considers in the 
circumstances that a penalty remains the appropriate course of 


action. 
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96. 


97. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited direct marketing messages is a matter of significant 
public concern. A monetary penalty in this case should act as a 
general encouragement towards compliance with the law, or at least 
as a deterrent against non-compliance, on the part of all persons 
running businesses currently engaging in these practices. The 
issuing of a monetary penalty will reinforce the need for businesses 
to ensure that they are only messaging those who specifically 


consent to receive direct marketing. 


For these reasons, the Commissioner has decided to issue a 


monetary penalty in this case. 


The amount of the penalty 


98. 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £80,000 (eighty thousand pounds) 
is reasonable and proportionate given the particular facts of the 


case and the underlying objective in imposing the penalty. 


Conclusion 


99. 


100. 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 28 April 2022 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid 
into the Consolidated Fund which is the Government’s general bank 


account at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty 


by 27 April 2022 the Commissioner will reduce the monetary 
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101. 


102. 


103. 


104. 


105. 


penalty by 20% to £64000 (sixty four thousand pounds). 
However, you should be aware that the early payment discount is 


not available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information 


Rights) against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 


days of the date of this monetary penalty notice. 


Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary 


penalty unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the 


monetary penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and 


any variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 


recoverable by Order of the County Court or the High Court. In 
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Scotland, the monetary penalty can be enforced in the same 
manner as an extract registered decree arbitral bearing a warrant 
for execution issued by the sheriff court of any sheriffdom in 


Scotland. 


Dated the 29 March 2022 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any 
person upon whom a monetary penalty notice has been served a 
right of appeal to the First-tier Tribunal (Information Rights) (the 
‘Tribunal’) against the notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is 


not in accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have 


exercised his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision 
as could have been made by the Commissioner. In any other case 


the Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 
Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0203 936 8963 
Email: grc@ justice.gov.uk 


a) The notice of appeal should be sent soit is received by 
the Tribunal within 28 days of the date of the notice. 


b) If your notice of appeal is late the Tribunal will not 
admit it unless the Tribunal has extended the time for 
complying with this rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered 


to you; 


C) the name and address of the Information 


Commissioner; 


d) details of the decision to which the proceedings relate; 


e) the result that you are seeking; 


f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above 


the notice of appeal must include a request for an extension 
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of time and the reason why the notice of appeal was not 


provided in time. 


5; Before deciding whether or not to appeal you may wish to 
consult your solicitor or another adviser. At the hearing of an appeal 
a party may conduct his case himself or may be represented by any 


person whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 
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